Archive for June, 2008

Snort Signature Manager

Wednesday, June 18th, 2008

As far as I know, there’s really nothing that does this — at least nothing that does it the way I want to. As I have mentioned, Aanval has this functionality, but it is … horrible… at best. I’ve been working on writing a web-based signature management interface for the last few weeks. I currently have something that is stable, though slightly buggy. It’s not nearly done — I’ll likely make many changes in the near future. (Most noteably, support for multiple policies with inheritence.) Just in case anyone stumbles upon this and wants to help/try it, I’ve uploaded the code to http://www.uri.edu/security/software/sigmanager.tar.gz. …

rm -rf $SIG_DIR

Tuesday, June 3rd, 2008

Due to a cron job doing exactly what I told it to do, I lost all of my work on the signature management system I was writing :(. On the bright side, I uploaded the parser with my last post. (the working copy had some modifications, but nothing huge.). I’m about 90% done rewriting it, so not a *huge* loss, but it was shocking when I got to work and saw an emtpy directory. I was *going* to back it up today. he he he.